News for hackers. Stuff that matters.
Re:Zed Shaw: Why I Don't Use Tor by poet on Tuesday December 28, 2010 @08:28AM (#2045387)
It's shit like this Zed...

Two basic claims: Tor is tainted because (1) the concepts the software is based on were developed with partial funding from the military and (2) Zed thinks one of the committers is untrustworthy. Guess what? That describes a huge amount of software, including Mac OS X and Firefox. God damn Zed, this Hitler sandwich shit is pretty weak.

Zed also has a problem with Tor because he thinks there is a "gigantic percentage of hackers and security experts on the volunteer payroll of a group who's job is to illegally wiretap people and circumvent the law on behalf of the government". He thinks some of these people work on Tor and thus Tor is untrustworthy. Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy.

There are serious problems with using Tor and Zed fails to mention any of them. You'll want to read what Thomas has to say on the subject (http://searchyc.com/tptacek). Specifically, Thomas mentions that a general problem with tools like Tor is that it identifies your traffic as a subset of all traffic thats probably worth monitoring. You're essentially adding bright red neon signs to your most sensitive traffic. The amount of traffic going through the Tor network is small enough that it is a tractable problem for a nation state to attempt to monitor all of it. Thomas also goes into how the incentive structure for these tools is completely broken. The defenders are academic researchers going for tenure, the attackers are nation states with millions of dollars to spend, and the users are dissidents that get killed when the tool fails. Unfortunately, arguments with this level of nuance appear to escape Zed in this case. I fear he doesn't have the domain knowledge to write something intelligent about this issue.

Re:Zed Shaw: Why I Don't Use Tor by pingswept on Tuesday December 28, 2010 @12:21PM (#2046010)
Re:Zed Shaw: Why I Don't Use Tor by dkarl on Tuesday December 28, 2010 @12:27PM (#2046032)
Thing is, you don't have to believe Firefox is trustworthy to believe it's your best bet for surfing the web. The whole point of Tor is to be trustworthy; hence, there's no point in it if you don't trust it. Plus, like you said, using Tor may be worse than nothing, so you have to have a pretty strong motivation and pretty strong trust. Using Firefox or OSX requires no such trust.
Re:Zed Shaw: Why I Don't Use Tor by poet on Tuesday December 28, 2010 @01:24PM (#2046222)
A comprised web browser or operating system gives the attacker your email credentials, which by proxy gives them the rest of your life. You're trying to argue that an untrustworthy browser/OS is not as significant as an untrustworthy Tor. There isn't such an argument to be made. Browsers and operating systems require trust.
Re:Zed Shaw: Why I Don't Use Tor by dkarl on Tuesday December 28, 2010 @01:32PM (#2046258)
No, all they require is being just as trustworthy as the other browsers and operating systems, even if that level is zero. Tor is an extra inconvenience and calls extra attention to you and therefore requires a credible claim of providing extra security to make up for the downside.
Re:Zed Shaw: Why I Don't Use Tor by poet on Tuesday December 28, 2010 @02:22PM (#2046417)
Nope. If the trustworthiness of all browsers was zero, people would do their banking in person. You're trying to get away with arguing only the relative and not absolute trust of browsers is the only thing that matters. Not gonna happen.
Re:Zed Shaw: Why I Don't Use Tor by dkarl on Tuesday December 28, 2010 @02:48PM (#2046510)
Security is relative and depends on your particular goals. I may have zero confidence that the government has not subverted Firefox, but that would not stop me from using it. If there are government back doors in Firefox, they aren't being exploited on a large scale for robbery or identity theft, and that makes it good enough for online banking. It wouldn't make Firefox good enough for evading government surveillance, but depending on your purposes, using a web browser you don't trust might be better than not using a web browser at all.

If someone of sufficient expertise decides to hack you and take your banking info, they will, just like if someone decides to rob you on the street, they will. We assume there are vulnerabilities in any piece of software as big as Firefox. Your security depends on not being a particularly tempting individual target for highly skilled attackers and staying up-to-date enough to avoid mass automated attacks, and those factors depend on relative risks that can't even be objectively measured.

Edit/PS: I am also confident that the government would not insert back doors that are likely to be found by criminals, because those vulnerabilities would be exploited by foreign governments and would hurt U.S. commercial interests, which I imagine is the only kind of mistake that would result in Congress taking drastic punitive action (slashing budgets, reducing autonomy, increasing oversight) towards an intelligence agency.

Re:Zed Shaw: Why I Don't Use Tor by zedshaw on Tuesday December 28, 2010 @01:35PM (#2046267)
Thomas is very right, but I was more interested in my reasons why I don't use Tor based on all the crap I see going on around it.
Re:Zed Shaw: Why I Don't Use Tor by poet on Tuesday December 28, 2010 @02:40PM (#2046478)
Do you avoid software like FreeBSD, Linux, Mac OS X, and all other software that fits the criteria of your post? Point is, you have shitty reasons and probably aren't consistant in your application of them. Government funding and a committer you don't like preclude the usage of a huge amount of software.

    curl -s http://www.kernel.org/pub/linux/kernel/CREDITS | grep gov
    E: [email protected]
    E: [email protected]


    curl -s http://gcc.gnu.org/viewcvs/trunk/MAINTAINERS?view=co | grep gov
    Asher Langton					[email protected]
My general frustation with your blog post is that your arguments apply to many popular pieces of software. It feels disingenuous and it feels like it's provocative solely for the purpose of being provocative.
Re:Zed Shaw: Why I Don't Use Tor by krainboltgreene on Tuesday December 28, 2010 @11:13AM (#2045804)
> Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy.

You don't need TOR. You do need an ISP.

Re:Zed Shaw: Why I Don't Use Tor by borism on Tuesday December 28, 2010 @11:23AM (#2045832)
you need trust in both of them as a netizen, and I have trust in Tor, but not my ISP.
Re:Zed Shaw: Why I Don't Use Tor by spiritomb on Tuesday December 28, 2010 @01:33PM (#2046261)
hide a stone among stones and a man among men